Comment on PSA: Update your Tailscale!
lemmyvore@feddit.nl 4 days agoI mean, “plain WG” doesn’t have the ability to connect multiple sites seamlessly, nevermind from behind NAT. That’s what Headscale/Tailscale do, they enable multiple WG backends to connect together on the fly into a common VLAN, with almost zero extra config.
It may seem overkill if you only want to connect two sites but once you solve this problem for 2 it’s basically also solved for N so why not take advantage of the capability.
hirihit640@sh.itjust.works 3 days ago
Doesn’t Tailscale do a lot more, like ACLs and tailnet lock and a web ui and everything? I thought Headscale was trying to provide the same, though I admit I’ve never tried it myself
lemmyvore@feddit.nl 3 days ago
It does, there’s a lot of features and UI added on top of it because it’s primarily an enterprise-oriented service and large companies tend to have a lot more complex usage scenarios than self-hosters.
Headscale is a FOSS reimplementation from scratch of some of the Tailscale proprietary features. It’s inteded as a fallback option for Tailscale users in case the Tailscale service ever enshittifies, and also as a canary for ongoing verification of the Tailscale claim that the client plane functionality is entirely FOSS and above-board.
Speaking of which, Tailscale today is a great example of a company using FOSS well. They are able to provide commercial services and have proprietary code while at the same time opening the client-facing code so users can see for themselves their privacy is cryptographically proven. They also cooperate very well with Headscale and provide a generous gratis service tier.
hirihit640@sh.itjust.works 3 days ago
My issue with Headscale is that it seems like they are providing a very complex product and haven’t had any security audits (at least last I checked)…
Wireguard is nice because it is very simple, and thus has a much smaller attack surface.